1// Copyright (c) 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "chrome/browser/policy/preg_parser_win.h"
6
7#include <windows.h>
8
9#include <algorithm>
10#include <iterator>
11#include <vector>
12
13#include "base/basictypes.h"
14#include "base/files/file_path.h"
15#include "base/files/memory_mapped_file.h"
16#include "base/logging.h"
17#include "base/stl_util.h"
18#include "base/strings/string16.h"
19#include "base/strings/string_util.h"
20#include "base/strings/utf_string_conversions.h"
21#include "base/sys_byteorder.h"
22#include "base/values.h"
23#include "chrome/browser/policy/policy_load_status.h"
24#include "chrome/browser/policy/registry_dict_win.h"
25
26namespace policy {
27namespace preg_parser {
28
29const char kPRegFileHeader[8] =
30    { 'P', 'R', 'e', 'g', '\x01', '\x00', '\x00', '\x00' };
31
32// Maximum PReg file size we're willing to accept.
33const int64 kMaxPRegFileSize = 1024 * 1024 * 16;
34
35// Constants for PReg file delimiters.
36const char16 kDelimBracketOpen = L'[';
37const char16 kDelimBracketClose = L']';
38const char16 kDelimSemicolon = L';';
39
40// Registry path separator.
41const char16 kRegistryPathSeparator[] = L"\\";
42
43// Magic strings for the PReg value field to trigger special actions.
44const char kActionTriggerPrefix[] = "**";
45const char kActionTriggerDeleteValues[] = "deletevalues";
46const char kActionTriggerDel[] = "del.";
47const char kActionTriggerDelVals[] = "delvals";
48const char kActionTriggerDeleteKeys[] = "deletekeys";
49const char kActionTriggerSecureKey[] = "securekey";
50const char kActionTriggerSoft[] = "soft";
51
52// Returns the character at |cursor| and increments it, unless the end is here
53// in which case -1 is returned.
54int NextChar(const uint8** cursor, const uint8* end) {
55  // Only read the character if a full char16 is available.
56  if (*cursor + sizeof(char16) > end)
57    return -1;
58
59  int result = **cursor | (*(*cursor + 1) << 8);
60  *cursor += sizeof(char16);
61  return result;
62}
63
64// Reads a fixed-size field from a PReg file.
65bool ReadFieldBinary(const uint8** cursor,
66                     const uint8* end,
67                     int size,
68                     uint8* data) {
69  const uint8* field_end = *cursor + size;
70  if (field_end > end)
71    return false;
72  std::copy(*cursor, field_end, data);
73  *cursor = field_end;
74  return true;
75}
76
77bool ReadField32(const uint8** cursor, const uint8* end, uint32* data) {
78  uint32 value = 0;
79  if (!ReadFieldBinary(cursor, end, sizeof(uint32),
80                       reinterpret_cast<uint8*>(&value))) {
81    return false;
82  }
83  *data = base::ByteSwapToLE32(value);
84  return true;
85}
86
87// Reads a string field from a  file.
88bool ReadFieldString(const uint8** cursor, const uint8* end, string16* str) {
89  int current = -1;
90  while ((current = NextChar(cursor, end)) > 0x0000)
91    *str += current;
92
93  return current == L'\0';
94}
95
96std::string DecodePRegStringValue(const std::vector<uint8>& data) {
97  size_t len = data.size() / sizeof(char16);
98  if (len <= 0)
99    return std::string();
100
101  const char16* chars = reinterpret_cast<const char16*>(vector_as_array(&data));
102  string16 result;
103  std::transform(chars, chars + len - 1, std::back_inserter(result),
104                 std::ptr_fun(base::ByteSwapToLE16));
105  return UTF16ToUTF8(result);
106}
107
108// Decodes a value from a PReg file given as a uint8 vector.
109bool DecodePRegValue(uint32 type,
110                     const std::vector<uint8>& data,
111                     scoped_ptr<base::Value>* value) {
112  switch (type) {
113    case REG_SZ:
114    case REG_EXPAND_SZ:
115      value->reset(base::Value::CreateStringValue(DecodePRegStringValue(data)));
116      return true;
117    case REG_DWORD_LITTLE_ENDIAN:
118    case REG_DWORD_BIG_ENDIAN:
119      if (data.size() == sizeof(uint32)) {
120        uint32 val = *reinterpret_cast<const uint32*>(vector_as_array(&data));
121        if (type == REG_DWORD_BIG_ENDIAN)
122          val = base::NetToHost32(val);
123        else
124          val = base::ByteSwapToLE32(val);
125        value->reset(base::Value::CreateIntegerValue(static_cast<int>(val)));
126        return true;
127      } else {
128        LOG(ERROR) << "Bad data size " << data.size();
129      }
130      break;
131    case REG_NONE:
132    case REG_LINK:
133    case REG_MULTI_SZ:
134    case REG_RESOURCE_LIST:
135    case REG_FULL_RESOURCE_DESCRIPTOR:
136    case REG_RESOURCE_REQUIREMENTS_LIST:
137    case REG_QWORD_LITTLE_ENDIAN:
138    default:
139      LOG(ERROR) << "Unsupported registry data type " << type;
140  }
141
142  return false;
143}
144
145// Adds the record data passed via parameters to |dict| in case the data is
146// relevant policy for Chromium.
147void HandleRecord(const string16& key_name,
148                  const string16& value,
149                  uint32 type,
150                  const std::vector<uint8>& data,
151                  RegistryDict* dict) {
152  // Locate/create the dictionary to place the value in.
153  std::vector<string16> path;
154
155  Tokenize(key_name, kRegistryPathSeparator, &path);
156  for (std::vector<string16>::const_iterator entry(path.begin());
157       entry != path.end(); ++entry) {
158    if (entry->empty())
159      continue;
160    const std::string name = UTF16ToUTF8(*entry);
161    RegistryDict* subdict = dict->GetKey(name);
162    if (!subdict) {
163      subdict = new RegistryDict();
164      dict->SetKey(name, make_scoped_ptr(subdict));
165    }
166    dict = subdict;
167  }
168
169  if (value.empty())
170    return;
171
172  std::string value_name(UTF16ToUTF8(value));
173  if (!StartsWithASCII(value_name, kActionTriggerPrefix, true)) {
174    scoped_ptr<base::Value> value;
175    if (DecodePRegValue(type, data, &value))
176      dict->SetValue(value_name, value.Pass());
177    return;
178  }
179
180  std::string action_trigger(StringToLowerASCII(value_name.substr(
181      arraysize(kActionTriggerPrefix) - 1)));
182  if (action_trigger == kActionTriggerDeleteValues) {
183    std::vector<std::string> values;
184    Tokenize(DecodePRegStringValue(data), ";", &values);
185    for (std::vector<std::string>::const_iterator value(values.begin());
186         value != values.end(); ++value) {
187      dict->RemoveValue(*value);
188    }
189  } else if (StartsWithASCII(action_trigger, kActionTriggerDeleteKeys, true)) {
190    std::vector<std::string> keys;
191    Tokenize(DecodePRegStringValue(data), ";", &keys);
192    for (std::vector<std::string>::const_iterator key(keys.begin());
193         key != keys.end(); ++key) {
194      dict->RemoveKey(*key);
195    }
196  } else if (StartsWithASCII(action_trigger, kActionTriggerDel, true)) {
197    dict->RemoveValue(
198        value_name.substr(arraysize(kActionTriggerPrefix) - 1 +
199                          arraysize(kActionTriggerDel) - 1));
200  } else if (StartsWithASCII(action_trigger, kActionTriggerDelVals, true)) {
201    // Delete all values.
202    dict->ClearValues();
203  } else if (StartsWithASCII(action_trigger, kActionTriggerSecureKey, true) ||
204             StartsWithASCII(action_trigger, kActionTriggerSoft, true)) {
205    // Doesn't affect values.
206  } else {
207    LOG(ERROR) << "Bad action trigger " << value_name;
208  }
209}
210
211bool ReadFile(const base::FilePath& file_path,
212              const string16& root,
213              RegistryDict* dict,
214              PolicyLoadStatusSample* status) {
215  base::MemoryMappedFile mapped_file;
216  if (!mapped_file.Initialize(file_path) || !mapped_file.IsValid()) {
217    PLOG(ERROR) << "Failed to map " << file_path.value();
218    status->Add(POLICY_LOAD_STATUS_READ_ERROR);
219    return false;
220  }
221
222  if (mapped_file.length() > kMaxPRegFileSize) {
223    LOG(ERROR) << "PReg file " << file_path.value() << " too large: "
224               << mapped_file.length();
225    status->Add(POLICY_LOAD_STATUS_TOO_BIG);
226    return false;
227  }
228
229  // Check the header.
230  const int kHeaderSize = arraysize(kPRegFileHeader);
231  if (mapped_file.length() < kHeaderSize ||
232      memcmp(kPRegFileHeader, mapped_file.data(), kHeaderSize) != 0) {
233    LOG(ERROR) << "Bad policy file " << file_path.value();
234    status->Add(POLICY_LOAD_STATUS_PARSE_ERROR);
235    return false;
236  }
237
238  // Parse file contents, which is UCS-2 and little-endian. The latter I
239  // couldn't find documentation on, but the example I saw were all
240  // little-endian. It'd be interesting to check on big-endian hardware.
241  const uint8* cursor = mapped_file.data() + kHeaderSize;
242  const uint8* end = mapped_file.data() + mapped_file.length();
243  while (true) {
244    if (cursor == end)
245      return true;
246
247    if (NextChar(&cursor, end) != kDelimBracketOpen)
248      break;
249
250    // Read the record fields.
251    string16 key_name;
252    string16 value;
253    uint32 type = 0;
254    uint32 size = 0;
255    std::vector<uint8> data;
256
257    if (!ReadFieldString(&cursor, end, &key_name))
258      break;
259
260    int current = NextChar(&cursor, end);
261    if (current == kDelimSemicolon) {
262      if (!ReadFieldString(&cursor, end, &value))
263        break;
264      current = NextChar(&cursor, end);
265    }
266
267    if (current == kDelimSemicolon) {
268      if (!ReadField32(&cursor, end, &type))
269        break;
270      current = NextChar(&cursor, end);
271    }
272
273    if (current == kDelimSemicolon) {
274      if (!ReadField32(&cursor, end, &size))
275        break;
276      current = NextChar(&cursor, end);
277    }
278
279    if (current == kDelimSemicolon) {
280      if (size > kMaxPRegFileSize)
281        break;
282      data.resize(size);
283      if (!ReadFieldBinary(&cursor, end, size, vector_as_array(&data)))
284        break;
285      current = NextChar(&cursor, end);
286    }
287
288    if (current != kDelimBracketClose)
289      break;
290
291    // Process the record if it is within the |root| subtree.
292    if (StartsWith(key_name, root, false))
293      HandleRecord(key_name.substr(root.size()), value, type, data, dict);
294  }
295
296  LOG(ERROR) << "Error parsing " << file_path.value() << " at offset "
297             << reinterpret_cast<const uint8*>(cursor - 1) - mapped_file.data();
298  status->Add(POLICY_LOAD_STATUS_PARSE_ERROR);
299  return false;
300}
301
302}  // namespace preg_parser
303}  // namespace policy
304